200-301 · Question #970
Refer to the exhibit. A network engineer started to configure port security on a new switch. These requirements must be met: - MAC addresses must be learned dynamically - Log messages must be generate
The correct answer is A. SW(ccnfig-if)#switchport port-security mac-address sticky B. SW(config-if)#switchport port-security violation restriction restrict. To configure port security to dynamically learn MAC addresses and generate log messages without disabling the interface upon violations, the switchport port-security mac-address sticky command should be used for learning, and switchport port-security violation restrict for the de
Question
Exhibits
Options
- ASW(ccnfig-if)#switchport port-security mac-address sticky
- BSW(config-if)#switchport port-security violation restriction restrict
- CSW(config-if)#switchport port-security mac-address 0010.7B84.45E6
- DSW(config-if)#switchport port-security maximum 2
- ESW(ccnfig-if)#switchport port-security violation shutdown
How the community answered
(25 responses)- A80% (20)
- C4% (1)
- D12% (3)
- E4% (1)
Why each option
To configure port security to dynamically learn MAC addresses and generate log messages without disabling the interface upon violations, the `switchport port-security mac-address sticky` command should be used for learning, and `switchport port-security violation restrict` for the desired violation mode.
The `switchport port-security mac-address sticky` command enables sticky learning, which dynamically learns MAC addresses and stores them in the running configuration, meeting the requirement for dynamic learning.
The `switchport port-security violation restrict` command sets the violation mode to restrict, which drops violating frames, increments a security violation counter, and generates an SNMP trap and a syslog message, satisfying the requirement to generate log messages without disabling the interface.
`switchport port-security mac-address 0010.7B84.45E6` statically configures a MAC address, which contradicts the requirement for dynamically learned MAC addresses.
`switchport port-security maximum 2` limits the number of learned MAC addresses but doesn't fulfill the requirements for dynamic learning or the specific violation action.
`switchport port-security violation shutdown` causes the interface to shut down when a security violation occurs, which goes against the requirement to NOT disable the interface.
Concept tested: Cisco switch port security configuration (sticky MAC, violation modes)
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_44_se/configuration/guide/scg/swportsc.html
Topics
Community Discussion
No community discussion yet for this question.

